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Summary 


Section 48 of the Freedom of Information Act (FOIA) empowers the information Commissioner (the Commissioner) to issue a 
practice recommendation where it appears to him that a public authority has failed to conform, specifically, to the FOIA 
Codes of Practice. These failures are addressed in the recommendations section below. 


Prior to 2021 MHRA had manageable levels of information requests and systems in place which were sufficient to cope with 
those volumes. However, volumes and the complexity of information requests (especially with the introduction of covid 
vaccines) has increased from 2021/2022 onwards and it has become increasingly apparent that its systems and procedures 
are no longer fit for purpose or sufficient to meet increased volumes and increasing levels of complexity. 


MHRA has therefore shown a declining trend in performance in terms of the time limits for complying with information 
requests. It has also consistently failed to carry out internal reviews within the recommended timeframes. Following 
engagement by his staff with MHRA about the underlying reasons for these failings, the Commissioner has reached the view 
that MHRA’s request handling practices do not conform to parts 4 and 5 of the section 45 Freedom of Information Code of 
Practice, issued by the Cabinet Office in July 2018 (the Code). 


Recommendations 


The Commissioner has recently had discussions with MHRA concerning the issues set out above and is aware that it is in the 
process of implementing a number of improvements to its information request handling processes. MHRA has drawn up an 
action plan designed to remedy the current position and bring its request handling back to acceptable levels of compliance. 
The Commissioner has therefore designed the following recommendations to support and enhance MHRA’s plans to improve 
its information rights practices. In considering these recommendations, he expects MHRA to ensure that it meets the 
requirements of all information rights legislation to which it is subject. 
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Area of Code Non-conformity 

e Part 4 -time limits for For the period 1 May to 31 May 
responding to requests 2023 MRHA had only met the 

deadline ‘in time’ in 71% of its 

Section 4.1 of the Code information requests. It also 
highlights the “clear” received 6 section 10 decision 
requirement that public notices between 30 March and 
authorities respond to 18 May 2023. It had 32 
requests for information information requests over 6 
promptly, and within 20 months old, with the oldest at 
working days of receipt in this time being 6 July 2022. 
accordance with section 10(1) 
of FOIA. 


Recommendation of steps to be taken 


MHRA should consider using the Commissioner's FOI 
self-assessment toolkit to improve its timeliness 
compliance. 


MHRA should also request a consensual audit of its 
FOIA policies, practices and procedures from the ICO. 


MHRA should ensure that requests for information are 
responded to in a timely manner in accordance with 
section 10(1) of FOIA. When chased to issue responses 
by the Commissioner’s Case Officers, MHRA should 
respond in a timely and appropriate manner. This will 
avoid unnecessary decision notices and subsequent 
further delays for the requesters. 


MHRA should analyse and review its current request 
handling procedures to ensure that it has adequate 
long term resources in the right areas . Its systems 
and procedures need to be able to cope with sustained 
increased volumes. For example introduce a case 
management system or consider a dedicated FOI 
request handling areas which is separate to general 
enquiries and other correspondence. It should also 
consider developing an FOIA policy that enables it to 
respond to the increased volumes of information 
requests within the statutory or recommended 
timeframes. 
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MHRA should ensure that its processes enable it to 
comply with the requirements of the Commissioner’s 
decision notices in the timeframes they specify. 


MHRA should publish its action plan, which 
incorporates any recovery plan already in 
development, with appropriate processes put into place 
to ensure 90% timeliness is achieved by 31‘ 
December 2023. This action plan should be supported 
by a ‘lessons learned’ exercise, which examines the 
root cause of delays from allocation through to 
clearance at different stages, with mitigations for any 
recurring problems addressed specifically in the plan. 
MHRA must ensure that its information rights training 
is sufficient and delivered to all staff to ensure that all 
information requests are processed within the required 
timeframes. This should include training on recognising 
information requests on receipt so that they are 
transferred to the relevant staff for processing in a 
timely manner, seeking clarification early if MHRA is 
uncertain what information is required. It should also 
identify where training is required for specific 
exemptions and delivering this to all relevant staff. 
MHRA’s request handling procedures should include 
provision for when a response is late, or is likely to be 
late at any stage of the internal processes. It must be 
clear when and to whom the matter will be escalated, 
who is responsible for taking action, the action they 
will need to take, and by when. 
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Part 5 -— Internal reviews 
Sections 5.4 and 5.5 of the 
Code establish that internal 
reviews should be carried out 
within 20 working days, or 40 
working days where the 
matter is complex. 


Between 1 May and 31 May 
2023 MHRA had 19 open 
internal reviews, of which 13 
were overdue. 


In accordance with part 8.5 of the Code MRHA should 
publish its information access request statistics and 
make these easily accessible on its website. The 
statistics should include the number of information 
access requests that have not been processed and the 
number of completed requests where the processing 
took longer than 20 working days. 


MHRA should also consider publishing its responses to 
information requests on its disclosure log and making 
this information easily accessible on its website. For 
those FOIA responses issued since this practice was 
suspended approximately 2 years ago, consider putting 
a back catalogue together of those responses and 
making that available on its website. 


MHRA should ensure that internal reviews are carried 
out and the outcome communicated to the requester in 
a timely manner. In order to ensure that this happens 
consistently, MHRA should refresh its procedures for 
carrying out internal reviews and ensure that these are 
effective and robust. 
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Reasons for issuing this Practice Recommendation 


The Commissioner is issuing a Practice Recommendation at this time, rather than an Enforcement Notice, because MHRA has 
engaged openly with his Office about the problems it is facing. It has also put together an action plan, detailing what it needs 
to address in order to bring its compliance with FOIA back up to acceptable standards. 


Through the evidence provided in a series of complaints, it appears that the handling of information requests within MHRA 
has declined and has fallen below the expectations set out in the Section 45 Code of Practice. As outlined above the volume 
of complaints received by the Commissioner relating to a lack of timeliness by the MHRA at various stages of the FOIA 
request process has surged in the past year. 


This practice recommendation formalises the Commissioner’s concerns and holds MHRA accountable for improving its 
freedom of information request handling practices and, in turn, increase public confidence and trust in its information rights 
practices. 


Failure to comply 


A practice recommendation cannot be directly enforced by the Commissioner. However, failure to comply with a practice 
recommendation may lead to a failure to comply with FOIA, which in turn may result in the issuing of an enforcement notice. 
Further, a failure to take account of a practice recommendation may lead in some circumstances to an adverse comment in a 
report to Parliament by the Commissioner. 


MHRA should write to the Commissioner each quarter before publishing the update set out in this recommendation on its 
website to update on progress against its action plan and the additional measures set out in this recommendation. A full year 
review of MHRA’s performance against its action plan and this practice recommendation should then be provided one year 
after the date that MHRA publishes its action plan. 
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The Commissioner will have regard to this practice recommendation in his handling of subsequent cases involving MHRA. 


MHRA should write to the Commissioner by December 31 2023 to confirm that it has complied with the recommendations 
above and to explain how it has achieved this. 


